Baby Doge DEX

CertiK2 addresses on BNB Chain

CertiK reviewed Baby Doge (Baby Doge DEX) on 6 Oct 2022: 18 findings, 0 critical; 7 marked fixed, 11 open.

No open critical findings
Open the reportOpen Baby Doge’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High201
Medium001
Low905
HighIncorrect Amount Used in SwapFixed

In the function `swaptoBuyBack()`, the following code snippet is implemented to swap a certain amount of `WETH` for `buyBackCoin1`. However, the amount of `WETH` that is used to buy back the token is mistakenly set to `buyBackAmount0`, which should be `buyBackAmount1` ```solidity=337 if (buyBackCoin1 != address(0)) { address[] memory path = new address[](2); path[0] = WETH; path[1] = buyBackCoin1; uint256[] memory amountOutMin = IBabyDogeV2Router02(router) .getAmountsOut(buyBackAmount0, path); IBabyDogeV2Router02(router).swapExactTokensForTokens( buyBackAmount0, amountOutMin[1], path, address(this), block.timestamp + 120 ); } ```

MediumInconsistant Deadline for SwapFixed

In the function `swaptoBuyBack()`, the deadline for the `IBabyDogeV2Router02(router).swapExactTokensForTokens` is set to `block.timestamp + 1200`, which is 20 minutes more than the block.timestamp. However, other swap deadlines are all set to `block.timestamp + 120`, which brings the inconsistency

Low`stopReward()` May Prolong Mining ActivityFixed

When the pool has stopped, the invocation of the function `stopReward()` may potentially extend the reward activity if `block.number` is given a value that is greater than the current `bonusEndBlock` by mistake. In this case, users can withdraw extra rewards which will cause a loss of the pool's assets.

Low`updatePoolLimitPerUser()` Can Not Be ExecutedFixed

Currently in the function `updatePoolLimitPerUser()`, once `hasUserLimit` was set to `false`, it can no longer be set to `true` through function `updatePoolLimitPerUser()`. Does this mean once the limit was removed, then it cannot be reset in the future?

LowInaccurate Messages And ErrorsFixed

```solidity require( _toBuyBackCoin0Percent <= 10000, "Has to be 10000" ); ``` The message should be "Has to be no more than 10000". --- Moreover, in L380 in contract `dexBuyBackFeeManager.sol`: ```solidity require(msg.sender == tx.origin, "Only Wallet"); ``` The message should be "Only EoA Wallet" or similar message because the wallet could be EoA or a wallet contract implementation.

LowLack of Input ValidationFixed

In the function `addLP()` and `replaceLP()`, `_pathTokenA` and `_pathTokenB` would be a path tokens that would be used in the AMM swap. However there's possibility that the `_pathTokenA` and `_pathTokenB` could be mistakenly inputted with same token calldata.

LowRedundant ValidationFixed

In the contract `dexTreasuryFeeManager` contract at the address of [0x1B6878aDfB16B949a8ceF2fB28228AFC84FCb6a8](https://bscscan.com/address/0x1B6878aDfB16B949a8ceF2fB28228AFC84FCb6a8#code), the if statement condition `instantSwapToStable == true` is redundant as the default value of `instantSwapToStable` is true and there's no other function to change its value.

Contracts in scope2

AddressChainSource code
0xbda7c402f9de8ad737cedc3ab7cbfecd53f29c74Chain: BNB ChainSource code: Verified source
0x1b6878adfb16b949a8cef2fb28228afc84fcb6a8Chain: BNB ChainSource code: Verified source

Part of Baby Doge’s security record

Baby Doge
Audits2 audits by 1 firmLast audit Oct 2023, by CertiK.
Critical findingsNo open critical findingsAcross 2 reports.
Open Baby Doge’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us